Kubescape Continuous Scanning Architecture

Kubescape Continuous Scanning Architecture An architecture diagram generated by Archify. CronJob Trigger · Schedule trigger · Kubernetes Cluster CronJob Trigger Schedule trigger Operator Controller · Coordinates scan requests · Kubernetes Cluster Operator Controller Coordinates scan requests Node Agent · Optional · kernel requirements · Kubernetes Cluster Node Agent Optional · kernel requirements Configuration Scanner · Configuration checks · Kubernetes Cluster Configuration Scanner Configuration checks Vulnerability Scanner · Optional · image CVEs · Kubernetes Cluster Vulnerability Scanner Optional · image CVEs Prometheus Exporter · Scan-result metrics · Kubernetes Cluster Prometheus Exporter Scan-result metrics Scan Targets · Workloads/RBAC within authorized API scope · Kubernetes Cluster Scan Targets Workloads/RBAC within authorized API scope CLI Snapshot / Diff · Explicit comparison baseline · Kubernetes Cluster CLI Snapshot / Diff Explicit comparison baseline Storage API · Aggregated API + PVC · Kubernetes Cluster Storage API Aggregated API + PVC Kubescape Cloud · Explicit account/submission · External Integrations Kubescape Cloud Explicit account/submission Alerting · Configured metrics/alert path · External Integrations Alerting Configured metrics/alert path SIEM / SOAR · Security operations integration · External Integrations SIEM / SOAR Security operations integration Schedule trigger Run scans Read results Optional runtime data Posture results Optional CVE results Optional CLI diff Publish results Configured alerts Kubernetes Cluster External Integrations

APIs and data

  • • spdx results: storage aggregated API
  • • SecurityException / ClusterSecurityException: kubescape.io/v1beta1
  • • Inspect RBAC and resource kinds for the installed version

Validation baseline

  • • CLI 4.0.14 / Operator chart 1.40.4
  • • Chart scanner 4.0.13 differs from local CLI 4.0.14
  • • Validate CPU/memory/PVC sizing for the workload

Schedule and permissions

  • • kubescapeScheduler.scanSchedule
  • • defaultFrameworks / requestBody.commands[].args.scanV1
  • • Choose node/runtime/remediation capabilities explicitly